Total ReDoS: the dangers of regex in JavaScript
summary
Explains concrete ReDoS cases and fixes: a simple A+\\$ pattern causes quadratic backtracking and crashed Stack Overflow for 34 minutes, complex .. sequences cause catastrophic exponential backtracking and knocked Cloudflare offline for 27 minutes. Shows offending patterns from node-fetch, node http-cache-semantic, Superhuman and Zod, demonstrates tools regexper, rex.rip and recheck, suggests fixes: limit input length, replace overlapped dot-star with negated classes, avoid nested quantifiers, or use Google's RE2 on the backend and CI eslint plugins to detect vulnerabilities.
AI-written summary · about
chapters (8)
- 0:00Introduction to ReDoS
- 3:36Regular backtracking
- 9:49Mitigation strategies
- 13:40Catastrophic backtracking
- 18:14Cloudflare incident analysis
- 22:50Email validation failures
- 30:44Refactoring and prevention
- 37:45Tools and concluding thoughts
related talks
38mTotal ReDoS: the Dangers of Regex in JavaScript
26mTotal ReDoS: The Dangers of regex in JavaScript
31mOh no! My regex is causing a Denial of Service! What can I do about it?
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
31mService Denied! Understanding How Regex DoS Attacks Work
01h 13m/ Reg (exp) {2} lained / Demystifying Regular Expressions
26mAll Aboard the Regular Express
42mThe Node.js Highway: Attacks Are At Full Throttle